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Please amend the claims as follows: 



1. (Original) A method for associating file activity of an application with the graphical display of the 
file on a screen comprising the steps of: 

loading by an operating system an executable code of a message monitoring program adapted to 
monitoring a message sent by an operating system to a document display window; 

establishing by the message monitoring program a system-wide window hook using available 
operating system API functions, said system-wide window hook associated with one or more 
functions in a library of said message monitoring program; 

loading the message monitoring program library into the memory space of an application 

program, said application having been newly started and having an import table and a newly 
created window; 

fixing the import table of the application with addresses of functions from the message 
monitoring program library; and 

substituting the application's main window function with a message monitoring program window 
function. 



2. (Original) The method of claim 1, further comprising creating a key window when an application is 

started, said key window adapted to receive a message when a file is opened and closed. 

3. (Original) The method of claim 2, further comprising: 

sending a message to the key window when a file is opened; 
creating a child notify window associated with said file; and 

creating a notify window as a child window of a document window associated with said file. 

4. (Original) The method of claim 1 , further comprising: 

creating a notify window when a document window is created, wherein the notify window is a 
child window of the document window; and 

receiving by the notify window a message from the operating system when the parent document 
window is activated by either the application program or by action of a user. 

5. (Original) The method of claim 1, further comprising, upon receipt of a document window destroy 

message by a document's notify window, checking for the existence of a child notify window 
associated with a file that was opened in association with said document, and acting upon said 
associated file before destroying said document window. 

6. (Original) The method of claim 5, comprising a user of an application specifying one or more rules 

to the application, each said rule indicating an action to be taken on said associated file before 
destroying said document window. 
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7. (Currently Amended) The method of claim 6, wherein an action includes encrypting said associated 

file, wherein encrypting comprises th e st e p of : 

creating a new file containing a template of the same format as said associated file, said new file 
including a header, wherein said herde rheader is not encrypted; 

copying to the new file a document summary in readable form; 

copying to the new file visual indicia representing that the file is encrypted; 

copying encrypted data from the associated file to the new file as a named stream, said encrypted 
data having a beginning and a length; and 

writing a code to a substitute stream to prevent the new file from being written over by a user. 

8. (Original) The method of claim 7, further comprising the step of including in the header a flag 

indicative of the type of encryption used on the associated file. 

9. (Original) The method of claim 7, further comprising the step of including in the header a flag 

indicative of a handling procedure to be performed on said encrypted file. 

10. (Original) The method of claim 7, further comprising the step of loading data from the encrypted 
file into a memory block containing other random data, said memory block having a beginning, 
wherein an offset from the beginning of the memory block of the data from the encrypted file 
changes each time the message monitoring program executable code is loaded. 

11. (Original) The method of claim 7, further comprising the step of including in the header a flag 
indicative of the length of the encrypted data, and a flag that allows the message monitoring 
program to search for the beginning of the encrypted data. 

12. (Original) The method of claim 5, wherein an action includes deleting a temporary file from a 
mass storage device, wherein the deletion includes the steps of wiping the device sectors of the 
data contained therein, and renaming the temporary file to a name consisting of one letter prior to 
deletion. 

13. (Original) The method of claim 12, wherein the wiping is performed in conformance with the 
standards set for in the United States National Industrial Security Program Operating Manual 

14. (Original) The method of claim 6, wherein an action includes compressing said associated file. 

15. (Original) The method of claim 6, wherein an action includes translating said associated file into 
another language. 



Page 9 of 16 



Serial No. 09/855,425 ^ Examiner: YIGDALL, Michael J. 

Atty. Docket No. 59095.010100 Group Art Unit: 2122 

16. (Original) The method of claim 6, wherein an action includes converting said associated file into 
another file format. 

17. (Original) The method of claim 6, wherein an action includes searching for a virus in said 
associated file. 

18. (Original) The method of claim 6, wherein an action includes altering text in said associated file. 

19. (Original) The method of claim 6, wherein an action includes changing or adding an optional 
setting to said associated file. 

20. (Original) The method of claim 6, wherein an action includes spell checking said associated file. 

21 . (Original) The method of claim 6, wherein an action includes creating a backup of said associated 
file. 

22. (Original) The method of claim 6, wherein an action includes versioning said associated file under 
a different name or stream each time said associated file is saved. 

23. (Original) The method of claim 6, wherein an action includes storing said associated file content in 
a remote location, and storing a reference of said associated file locally. 

24. (Original) The method of claim 6, wherein an action includes grammar checking said associated 
file. 

25. (Original) The method of claim 1, further comprising monitoring by the message monitoring 
program window function the creation of a document child window. 

26. (Currently Amended) A method for intercepting a software call to a function contained in a 
dynamically linked library comprising the steps of: 

loading an executable program into memory: 

obtaining from an operating system by an intercepting program the address of the executable 
program; 

locating in a header of the executable program a list of libraries and functions called by the 
executable program; 

substituting a function reference in an import table of the executable program with a reference to 
a function in a library of the intercepting program; and 

storing said function reference in an internal memory structure. 
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27. (Original) The method of claim 26, wherein said executable program header includes an import 
table, further comprising examining the import table in order to locate the list of libraries and 
functions called by the executable program, 

28. (Original) The method of claim 26, wherein the function reference is an ordinal number. 

29. (Original) The method of claim 26, wherein the function reference is a name. 

30. (Original) The method of claim 26, further comprising 

obtaining the address of a library, said library including an import table; and 

substituting a function reference in the import table of the library with a reference to a function in 
a library of the intercepting program. 

31. (Original) The method of claim 30, wherein the library address is obtained from the operating 
system. 

32. (Original) The method of claim 30, wherein the library address is obtained from the import table of 
the executable. 

33. (Original) The method of claim 26, further comprising replacing the address of an API function in 
the import table of the executable with the address of a function of the intercepting program, said 
function having a return value comprising a table of addresses of one or more functions, wherein 
the intercepting program function inspects the table of addresses returned by the API function and 
inserts one or more substitute function addresses into the table of addresses. 
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